registry / @anatolijlaptev1991/hermes-ru / 0.22.5

@anatolijlaptev1991/hermes-ru@0.22.5

Русская локализация Hermes Agent Desktop для Windows. defineLocale + build.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 243 KB of source, external domains: 127.0.0.1, api.github.com, example.com, matrix.org, mattermost.example.com

Source & flagged code

5 flagged

launcher/hermes-ru-launcher.jsView file

Lines 1-38javascript

1'use strict';

3/**

4 * hermes-ru-launcher.js — Self-healing launcher с автообновлением

5 *

6 * При запуске через ярлык «Hermes RU»:

7 * 1. Проверяет целостность перевода (app.asar.unpacked/dist)

8 * 2. Сравнивает локальную версию с последним релизом на GitHub

9 * 3. Если есть новая версия — скачивает, обновляет перевод, потом запускает Hermes

10 * 4. Запускает Hermes.exe

11 *

12 * Не убивает Hermes. Не трогает app.asar.

13 */

15const fs = require('fs');

16const path = require('path');

17const os = require('os');

18const https = require('https');

19const { spawn, execSync, execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

launcher/hermes-ru-launcher.jsView on unpkg · L18

21const DATA_DIR = path.join(os.homedir(), '.hermes', 'russian-loc');

22const HERMES_EXE_PATH_FILE = path.join(DATA_DIR, 'hermes-exe-path.txt');

23const VERSION_FILE = path.join(DATA_DIR, 'version.json');

24const GITHUB_API = 'https://api.github.com/repos/anatolijlaptev1991-ctrl/hermes-ru/releases/latest';

25const PENDING_MAX_AGE_MS = 24 * 60 * 60 * 1000;

26const LAUNCHER_LOCK_MAX_AGE_MS = 20 * 60 * 1000;

27const LAUNCHER_LOCK_FILE = path.join(DATA_DIR, 'launcher.lock');

28const LOG_FILE = path.join(DATA_DIR, 'hermes-ru.log');

29const LOG_ENABLED_FILE = path.join(DATA_DIR, '.log-enabled');

30let _logEnabled = null;

32function isLogEnabled() {

33 if (_logEnabled !== null) return _logEnabled;

34 if (process.env.HERMES_RU_LOG === '1') { _logEnabled = true; return true; }

35 if (process.env.HERMES_RU_LOG === '0') { _logEnabled = false; return false; }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

launcher/hermes-ru-launcher.jsView on unpkg · L18

36 _logEnabled = fs.existsSync(LOG_ENABLED_FILE);

37 return _logEnabled;

38}

Lines 501-541javascript

501 const sibling = path.join(path.dirname(process.execPath), process.platform === 'win32' ? 'npm.cmd' : 'npm');

502 return fs.existsSync(sibling) ? sibling : (process.platform === 'win32' ? 'npm.cmd' : 'npm'

Lines 861-901javascript

861 if (!runtimeCommitted) restoreSourceFiles(sourceSnapshot);

862 warn(`Self-heal не удался: ${error.message}`);

863 return 'failed';

864 }

865}

866async function checkAndUpdate(resourcesDir) {

867 const

assets/hermes-ru-icon.icoView file

•path = assets/hermes-ru-icon.ico kind = high_entropy_blob sizeBytes = 54031 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/hermes-ru-icon.icoView on unpkg

Source & flagged code

5 flagged · loading source

launcher/hermes-ru-launcher.jsView file

18const https = require('https'); L19: const { spawn, execSync, execFileSync } = require('child_process'); L20:

High

Child Process

Package source references child process execution.

launcher/hermes-ru-launcher.jsView on unpkg · L18

521try { L522: const output = execFileSync('powershell.exe', [ L523: '-NoProfile', '-Command',

High

Shell

Package source references shell execution.

launcher/hermes-ru-launcher.jsView on unpkg · L521

18const https = require('https'); L19: const { spawn, execSync, execFileSync } = require('child_process'); L20: ... L23: const VERSION_FILE = path.join(DATA_DIR, 'version.json'); L24: const GITHUB_API = 'https://api.github.com/repos/anatolijlaptev1991-ctrl/hermes-ru/releases/latest'; L25: const PENDING_MAX_AGE_MS = 24 * 60 * 60 * 1000; ... L33: if (_logEnabled !== null) return _logEnabled; L34: if (process.env.HERMES_RU_LOG === '1') { _logEnabled = true; return true; } L35: if (process.env.HERMES_RU_LOG === '0') { _logEnabled = false; return false; }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

launcher/hermes-ru-launcher.jsView on unpkg · L18

881try { L882: execSync('npm install -g @anatolijlaptev1991/hermes-ru@' + npmVersion, { L883: stdio: 'inherit', timeout: 120000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

launcher/hermes-ru-launcher.jsView on unpkg · L881

assets/hermes-ru-icon.icoView file

•path = assets/hermes-ru-icon.ico kind = high_entropy_blob sizeBytes = 54031 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/hermes-ru-icon.icoView on unpkg

Findings

5 High3 Medium4 Low

HighChild Processlauncher/hermes-ru-launcher.js

HighShelllauncher/hermes-ru-launcher.js

HighSame File Env Network Executionlauncher/hermes-ru-launcher.js

HighRuntime Package Installlauncher/hermes-ru-launcher.js

HighShips High Entropy Blobassets/hermes-ru-icon.ico

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

launcher/hermes-ru-launcher.jsView file

Lines 1-38javascript

1'use strict';

3/**

4 * hermes-ru-launcher.js — Self-healing launcher с автообновлением

5 *

6 * При запуске через ярлык «Hermes RU»:

7 * 1. Проверяет целостность перевода (app.asar.unpacked/dist)

8 * 2. Сравнивает локальную версию с последним релизом на GitHub

9 * 3. Если есть новая версия — скачивает, обновляет перевод, потом запускает Hermes

10 * 4. Запускает Hermes.exe

11 *

12 * Не убивает Hermes. Не трогает app.asar.

13 */

15const fs = require('fs');

16const path = require('path');

17const os = require('os');

18const https = require('https');

19const { spawn, execSync, execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

launcher/hermes-ru-launcher.jsView on unpkg · L18

21const DATA_DIR = path.join(os.homedir(), '.hermes', 'russian-loc');

22const HERMES_EXE_PATH_FILE = path.join(DATA_DIR, 'hermes-exe-path.txt');

23const VERSION_FILE = path.join(DATA_DIR, 'version.json');

24const GITHUB_API = 'https://api.github.com/repos/anatolijlaptev1991-ctrl/hermes-ru/releases/latest';

25const PENDING_MAX_AGE_MS = 24 * 60 * 60 * 1000;

26const LAUNCHER_LOCK_MAX_AGE_MS = 20 * 60 * 1000;

27const LAUNCHER_LOCK_FILE = path.join(DATA_DIR, 'launcher.lock');

28const LOG_FILE = path.join(DATA_DIR, 'hermes-ru.log');

29const LOG_ENABLED_FILE = path.join(DATA_DIR, '.log-enabled');

30let _logEnabled = null;

32function isLogEnabled() {

33 if (_logEnabled !== null) return _logEnabled;

34 if (process.env.HERMES_RU_LOG === '1') { _logEnabled = true; return true; }

35 if (process.env.HERMES_RU_LOG === '0') { _logEnabled = false; return false; }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

launcher/hermes-ru-launcher.jsView on unpkg · L18

36 _logEnabled = fs.existsSync(LOG_ENABLED_FILE);

37 return _logEnabled;

38}

Lines 501-541javascript

501 const sibling = path.join(path.dirname(process.execPath), process.platform === 'win32' ? 'npm.cmd' : 'npm');

502 return fs.existsSync(sibling) ? sibling : (process.platform === 'win32' ? 'npm.cmd' : 'npm'

Lines 861-901javascript

861 if (!runtimeCommitted) restoreSourceFiles(sourceSnapshot);

862 warn(`Self-heal не удался: ${error.message}`);

863 return 'failed';

864 }

865}

866async function checkAndUpdate(resourcesDir) {

867 const

assets/hermes-ru-icon.icoView file

•path = assets/hermes-ru-icon.ico kind = high_entropy_blob sizeBytes = 54031 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/hermes-ru-icon.icoView on unpkg